Are they? I've never been able to blame library authors or hold them accountable for code running in my production environment.

They are accountable for their library, you are accountable for putting it in your production environment.

If they fail you can stop using their library. If you fail your company can stop using you.